Bump css_parser to 3.0.0 (CVE-2026-53727) - #4353
Open
akostadinov-bot[bot] wants to merge 3 commits into
Open
Conversation
css_parser < 3.0.0 is vulnerable to SSRF and local file disclosure via @import following in attacker-controlled CSS with base_uri: set. While porta's usage is not exploitable (no attacker-controlled CSS, no base_uri: option), bumping to the patched version as defense-in-depth. Also bumps prawn-svg 0.32.0 -> 0.40.3 (required for css_parser >= 2.0 compatibility), along with transitive deps prawn 2.4.0 -> 2.5.0, pdf-core 0.9.0 -> 0.10.0, ttfunk 1.7.0 -> 1.8.0. THREESCALE-15563 Assisted-By: claude-opus-4-6 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
akostadinov
reviewed
Jul 22, 2026
| acts_as_tree (2.9.1) | ||
| activerecord (>= 3.0.0) | ||
| addressable (2.8.8) | ||
| addressable (2.9.0) |
Contributor
There was a problem hiding this comment.
@jlledom there was something with addressable but I forgot what it was 🤔
❌ 2 blocking issues (2 total)
|
![qltysh[bot]](https://avatars.githubusercontent.com/in/890766?s=60&v=4){kind=small}
|
|
||
| def traffic_graph_style(svg) | ||
| xml = Nokogiri::XML(svg) | ||
| xml.css('a').each { |a| a.replace(a.children) } |
akostadinov
reviewed
Jul 22, 2026
|
|
||
| def traffic_graph_style(svg) | ||
| xml = Nokogiri::XML(svg) | ||
| xml.css('a').each { |a| a.replace(a.children) } |
Contributor
There was a problem hiding this comment.
svg-graph wraps data points in elements (empty
URL) when show_data_points is true. prawn-svg 0.32 treated as a plain
container and ignored the href. prawn-svg 0.40 added a new Anchor element
class that creates PDF link annotations from them — even with an empty URL,
PDF viewers render a hover box.
Contributor
|
Attaching generated test PDFs for comparison. |
jlledom
reviewed
Jul 24, 2026
jlledom
left a comment
jlledom
left a comment
Contributor
There was a problem hiding this comment.
Code looks good to me. The licenses job is failing, though.
akostadinov
reviewed
Jul 24, 2026
| :versions: [] | ||
| :when: 2026-04-29 07:57:00.547859043 Z | ||
| - - :permit | ||
| - GPL-2.0-only |
akostadinov
force-pushed
the
THREESCALE-15563-bump-css-parser
branch
from
July 24, 2026 18:24
a2b8beb to
7a68e6a
Compare
prawn-svg 0.40+ converts <a xlink:href=""> elements into PDF link annotations. svg-graph generates these with empty URLs around data points when show_data_points is true, causing useless black hover boxes in PDF viewers. Strip them in traffic_graph_style which already does Nokogiri SVG manipulation. THREESCALE-15563 Assisted-By: claude-opus-4-6 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
akostadinov
force-pushed
the
THREESCALE-15563-bump-css-parser
branch
from
July 24, 2026 18:30
7a68e6a to
96fd318
Compare
Prawn/pdf-core/ttfunk migrated license metadata from deprecated SPDX-style identifiers (GPL-2.0, GPL-3.0) to modern SPDX identifiers (GPL-2.0-only, GPL-3.0-only). LICENSE file has not changed. Existing policy already permits GPL-2.0 and GPL-2.0+, so adding GPL-2.0-only aligns scanner metadata with existing approval policy.
akostadinov
force-pushed
the
THREESCALE-15563-bump-css-parser
branch
from
July 24, 2026 18:48
96fd318 to
4e90f3e
Compare
jlledom
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
css_parserfrom 1.21.1 to 3.0.0 to address CVE-2026-53727 (SSRF + local file disclosure via@importfollowing withbase_uri:)prawn-svgfrom 0.32.0 to 0.40.3 (required for css_parser 3.x compatibility)prawn2.4→2.5,pdf-core0.9→0.10,ttfunk1.7→1.8Exploitability assessment
Not exploitable in porta — included as defense-in-depth:
base_uri:option to be setapp/lib/pdf/report.rb) feeds server-generated SVG graph styles into css_parser — no user inputbase_uri:is never passed anywhere in the codebase, so the@import-following code path that triggers SSRF is deadload_uri!orread_remote_fileexist in porta's codeTest plan
css_parser3.0.0 API is backwards-compatible with porta's usage pattern (load_string!,add_block!,each_selector)report.rbcode path (color substitution + hardcoded CSS blocks)THREESCALE-15563
🤖 Generated with Claude Code